> Because everyone uses reproducible builds Of course not, but it is possible to do so. It can also be verified by trusted third parties, etc. > However, I be

> Because everyone uses reproducible builds Of course not, but it is possible to do so. It can also be verified by trusted third parties, etc. > However, I believe that most people use protonmail for convenience and that it fits the threat model of the average joe. If you're getting targeted by the NSA, you shouldn't use a browser with JIT enabled anyway. This is a non-sequitur. If you're starting to talk about average Joes with an unspecified threat model, surely GMail will be fine too, for some very low bar of "crooks can't hack my facebook". But there's obviously a big span inbetween that and "specifically targeted by intelligence agencies". More to the point, no matter your threat model, you should try not to do business with scammers. Firstly, out of moral imperative, and secondly, because your threat model might change.